sa-orchestration/includes/class-sa-llm-settings.php

<?php
defined( 'ABSPATH' ) || exit;

/**
 * LLM provider settings.
 *
 * Stored in a single WordPress option (`sa_orch_llm_settings`).
 * Local-dev posture only. Tokens are never displayed back; saving with an
 * empty token field preserves the existing token.
 *
 * Future: this layer is the attachment seam — when a real key vault /
 * SA-Core secret handling is wired up, replace the wp_options storage here
 * without changing the consumer surface (get(), has_token()).
 */
class SA_Orch_LLM_Settings {

    const OPTION = 'sa_orch_llm_settings';

    public static function get(): array {
        $defaults = [
            'enabled'      => false,
            'provider'     => 'simulated',
            'model'        => '',
            'api_base_url' => '',
            'api_token'    => '',
        ];
        $stored = get_option( self::OPTION, [] );
        if ( ! is_array( $stored ) ) $stored = [];
        return wp_parse_args( $stored, $defaults );
    }

    /**
     * Save settings. Token field preserves the existing value when input is empty.
     */
    public static function save( array $input ): void {
        $current = self::get();
        $new = [
            'enabled'      => ! empty( $input['enabled'] ),
            'provider'     => sanitize_key( $input['provider'] ?? 'simulated' ),
            'model'        => sanitize_text_field( $input['model'] ?? '' ),
            'api_base_url' => esc_url_raw( $input['api_base_url'] ?? '' ),
            'api_token'    => ! empty( $input['api_token'] )
                ? (string) $input['api_token']
                : (string) $current['api_token'],
        ];
        update_option( self::OPTION, $new );
    }

    public static function has_token(): bool {
        $s = self::get();
        return ! empty( $s['api_token'] );
    }

    /**
     * Public-facing label for the saved-token state. Never returns the value itself.
     */
    public static function token_status_label(): string {
        return self::has_token()
            ? '[token is set; leave blank to preserve, enter a new value to update]'
            : '[no token saved]';
    }
}